Privacy Policy

When you, as a recruiter or hiring-team member, sign up for the Service, we collect: name, work email, organization name and domain, role title, billing address, GSTIN where provided, IP address at signup, and authentication metadata (password hash, session tokens, MFA artifacts).

We use this data for: account provisioning, authentication, billing, GST compliance, fraud prevention, and customer support. We retain account data for the lifetime of the account plus seven years after account closure (Income Tax Act mandates a six-year retention; we add a one-year buffer for ambiguity).

When you use the Service to evaluate candidates, you become the data fiduciary under DPDP §2(i). We act as a data processor on your behalf. The data includes:

• Resume content the candidate uploaded or you imported
• Application metadata (role applied to, application date, source)
• Pipeline stage transitions and timestamps
• Interview scorecards your team submits
• Interview recordings (only when the candidate has explicitly consented, retained 30 days by default, candidate-revocable any time per DPDP §6)
• Messaging conversation content within the platform

Your processing obligations as the data fiduciary include obtaining and recording consent, providing candidate access on request, deleting on consent withdrawal, and notifying breaches. The Service provides tooling for each.

We do not sell candidate or recruiter data. We do not use candidate data to train models that other customers benefit from. We do not permit third-party advertising trackers on the recruiter dashboard. We do not share interview recordings with model providers without explicit recruiter and candidate consent.

We use the following sub-processors to deliver the Service. Each one handles data under its own published terms. We do not currently hold a negotiated Data Processing Agreement with every sub-processor on this list, so ask our DPO for the signed status of any one of them before you rely on it:

• Vercel (USA), hosting, edge compute, static asset CDN. EU-US Data Privacy Framework participant.
• Neon (Postgres), primary database. We confirm the current storage region in writing on request rather than stating one here, because the region is set per environment.
• 100ms (India), primary video room provider. India-region storage.
• Daily.co (USA), failover video provider.
• Stripe (USA), payment processing for international customers. Indian customers use Razorpay.
• Razorpay (India), payment processing for INR-denominated subscriptions.
• Sentry (USA), error monitoring. A key-name scrubber removes known credential and token fields before send. It is not a guarantee that no personal data ever reaches an error report.
• AI inference providers, Google (Gemini), DeepSeek (China), Anthropic (USA), OpenAI (USA) and Groq (USA). Resume text and contact details are sent to whichever provider is routed for the task, and DeepSeek is the primary provider for two resume-writing tasks. We hold no zero-retention or no-training agreement with any of them, so each provider's published API terms govern retention.
• PageIndex / VectifyAI (USA), structured PDF extraction. Receives the uploaded resume file itself when a PageIndex key is configured; without one we fall back to local parsing.
• Firebase (Google, USA), phone number verification for OTP sign-in and the phone-verified passport badge.
• Resend (USA), transactional and inbound email delivery. Recipient addresses and message bodies pass through it.

Some of the sub-processors above store or process data outside India, including in the United States, the European Union and China. Under DPDP §16 we rely on each sub-processor's published security and privacy commitments rather than on a negotiated agreement with every one of them. We publish this list so you can disclose it to your candidates as required.

Reasonable security safeguards under DPDP §8(8) include: multi-tenant Postgres row-level security (no cross-org data leaks at the database layer), HMAC-signed audit chain (every action is tamper-evident), encrypted-at-rest data (AES-256), encrypted-in-transit (TLS 1.3), and SAML SSO for enterprise. We document our full security posture at /hire/security.

Candidates whose data is processed via Neuradesk Hire have the following rights under DPDP §11. Requests should be directed to their applying organization (the data fiduciary) first; we will cooperate to fulfill requests within 30 days:

• Right to access all personal data we hold
• Right to correction of inaccurate data
• Right to erasure when the purpose is fulfilled
• Right to withdraw consent at any time
• Right to grievance redressal via the DPO
• Right to nominate another person to act on their behalf
• Right to be informed of any breach involving their data

Our Data Protection Officer is reachable at dpo@neuradeskai.com. If our response does not resolve your concern, you may escalate to the Data Protection Board of India.

When we update this Policy in a way that materially changes how we handle personal data, we will notify recruiter customers via email and the in-app banner, increment the version number, and re-collect explicit consent where DPDP requires it.

Questions about this Policy: privacy@neuradeskai.com
DPDP-specific requests: dpo@neuradeskai.com
Enterprise compliance reviews: sales@neuradeskai.com